To address these shortcomings, we focus on finding ways of making networks fail using natural, interpretable features.
Several prior approaches have been used for this, each with drawbacks.
One is to analyze examples in a test set that a DNN mishandles (e.g. [1]}, [2]}, [3]}), but this limits the search for weaknesses to a fixed dataset and is not useful for studying novel combinations of features.
Another approach is to search for failures over an easily-describable set of perturbations (e.g. [4]}, [5]}), but this requires performing an untargeted search over a restricted set of changes.
Finally, one can use more open-ended interpretability tools to gain insights about how networks (mis)handle features and then use them to construct adversarial examples.
However, prior approaches for this (e.g. [6]}, [7]}, [8]}, [9]}) have been limited to proofs of concept that have relied on a human to manually construct adversaries.
